Security · 2026-05-18

Quantum Key Distribution and Identity Systems: Separating the Signal from the Hype

By J. W. Bouckaert

A real capability, aimed at the wrong problem

Quantum Key Distribution is one of the few quantum technologies that has actually shipped. Toshiba, ID Quantique, QuantumXchange, and KETS Quantum sell hardware today. China's Micius satellite demonstrated entanglement-based QKD over 1,200 km between ground stations in 2017. The EU is funding EuroQCI, a continental quantum communication backbone targeted for 2027. The physics works, the standards exist (ETSI ISG QKD and the ITU-T Y.3800 series), and a handful of banks and government networks already pay for production deployments.

None of this changes the fact that QKD does almost nothing for the identity verification problem.

That is an uncomfortable claim to make in a market where "quantum-safe" has become a vendor checkbox, but it is the only conclusion the architecture supports. QKD solves key distribution between two fixed, line-of-sight, dedicated-fiber or dedicated-optical-link endpoints. Identity verification is a mobile, multi-device, multi-carrier, multi-jurisdiction problem where the endpoints change every session, the network path is the public internet, and the threat model is dominated by SIM swap, credential phishing, and agent impersonation, well away from eavesdropping on a symmetric key in transit.

These are different problems. They deserve different answers.

QKD

The protocol everyone references is BB84, published by Bennett and Brassard in 1984. Alice sends single photons polarized in one of two non-orthogonal bases. Bob measures them in a randomly chosen basis. They publicly compare a subset of bases (not values) over a classical channel, discard mismatches, and keep the rest as a shared random bit string. Heisenberg's uncertainty principle guarantees that any eavesdropper measuring the photons disturbs them in a statistically detectable way, so Alice and Bob can estimate the error rate and abort if it exceeds a threshold.

The output is a fresh symmetric key, distributed under the assumption that quantum mechanics is correct and the hardware behaves the way the spec says it does. That is a strong primitive. It is also a very narrow one.

The single most consequential row in that table is the second: QKD does not authenticate the endpoints. The protocol assumes Alice and Bob have already established an authenticated classical channel through some other mechanism—typically a pre-shared symmetric key, or a classical public-key signature. Without that, an attacker placed between Alice and Bob runs two independent QKD sessions, one with each side, and shares keys with both. The math is clean, the photons are real, and the man-in-the-middle is undisturbed.

That single property is why QKD cannot be the foundation of an identity system. Identity is, by definition, the problem of authenticating an endpoint. QKD assumes the answer.

The CNSA 2.0 position

If you are looking for an authoritative read on whether QKD belongs in an enterprise security architecture, the NSA's CNSA 2.0 guidance is the clearest available. NSA does not recommend QKD for National Security Systems. The reasoning, summarised in the NSA's QKD and QC FAQ, comes down to five concrete operational concerns:

1. QKD is only a partial solution. It distributes symmetric keys; it does not authenticate, sign, or provide integrity beyond the key.
2. QKD requires special-purpose equipment. Dedicated fibres or optical free-space links cannot be retrofitted onto general-purpose networks.
3. QKD increases infrastructure cost and insider-threat risk. Trusted-node relays multiply the number of locations holding plaintext key material.
4. Securing and validating QKD is significantly more challenging than for standard cryptography. Implementation vulnerabilities (detector blinding, Trojan-horse attacks, source side-channels) have repeatedly broken commercial QKD hardware in academic side-channel studies.
5. QKD increases denial-of-service risk. The eavesdropping detection is a feature only as long as legitimate traffic is willing to abort on noise.

The UK NCSC takes the same position: post-quantum cryptography, ahead of QKD, is the recommended path for protecting public and government networks against the quantum threat. The joint ANSSI / BSI / NLNCSA / Swedish Armed Forces position paper on QKD (2024) reaches a near-identical conclusion. Three of the most cryptographically literate signals-intelligence communities in the world independently looked at QKD and arrived at: not for general-purpose security, not as a substitute for PQC, and not without classical authentication underneath it.

That is the consensus. It is not a fringe view.

Identity's threat geometry

QKD optimises for one threat—passive eavesdropping on a key as it transits a single point-to-point link—and pays a steep cost in deployability to do it. Identity verification has a fundamentally different threat geometry:

• The legitimate user is mobile. Their device, network, SIM, IP, and physical location change constantly.
• The relying party is one of millions of websites, APIs, and AI agents, far from a fixed pair of endpoints.
• The dominant attacks are SIM swap, credential phishing, agent impersonation, and bearer-token theft—not photon-level interception.
• The answer is required inside the login request itself, across the public internet.
• The trust decision must survive the holder being offline, on a satellite link, or roaming on a foreign carrier.

A QKD link between a bank's data centre and a partner's data centre is genuinely useful for inter-site key replication. It does nothing to help that same bank decide whether the person logging in from a new device with a freshly-issued SIM is the legitimate account holder. The two problems share a word—"quantum"—and almost nothing else.

Identity's quantum requirements

The quantum risk to identity is concrete and quantifiable, and it has nothing to do with photons in transit. It has two layers.

Layer 1: signature forgeability. Once a Cryptographically Relevant Quantum Computer exists, every credential signed with RSA or ECC becomes retroactively forgeable. Audit trails lose non-repudiation. VC proofs lose binding. Session tokens lose integrity. This is the "harvest now, decrypt later" risk applied to signatures rather than encryption, and the timeline is short enough that 2026 procurement decisions have already started accounting for it. The mitigation is post-quantum signatures—specifically ML-DSA-65 (NIST FIPS 204), deployed in a hybrid envelope alongside a classical algorithm so neither single failure compromises the credential.

Layer 2: entropy quality. A post-quantum signature algorithm is only as strong as the randomness feeding it. ML-DSA-65 needs a 256-bit seed for key generation and a per-signature nonce. If those bits are predictable—and a CSPRNG seeded from a deterministic source is, in principle, predictable to a sufficiently advanced adversary—the algorithm's quantum resistance is irrelevant. The mitigation is QRNG-seeded entropy: bits derived from physical quantum phenomena (photon polarisation, vacuum fluctuations, beam-splitter statistics) that are non-deterministic at the physical level, not merely computationally unpredictable. PasskeyBridge sources this from Outshift primary and ANU as failover, XOR-hybridises with local CSPRNG output, and stretches through a NIST SP 800-90A-compliant AES-256-CTR-DRBG. The full pipeline is documented in the technical whitepaper.

Neither of these is QKD. Both are deployable today, on commodity hardware, over the public internet, for mobile endpoints. They address the actual quantum risk to identity. QKD addresses a different risk on a different topology, and trying to bolt it onto an identity stack is a category error.

The place for QKD

This is not an anti-QKD article. QKD has legitimate, defensible use cases, and over the next decade some of them will mature into production infrastructure. The honest version of the answer is:

The pattern is consistent: QKD is a fixed-infrastructure key-distribution primitive for bulk symmetric material between trusted institutional endpoints. Everywhere identity actually lives—on phones, in browsers, across carriers, between AI agents, across orbital links—it is the wrong primitive.

Trusted nodes

One more architectural detail is worth naming, because it is routinely glossed over in vendor materials. Terrestrial QKD ranges out at roughly 100 to 200 kilometres on dark fibre before photon loss and noise overwhelm the protocol. Beyond that, real-world deployments rely on trusted nodes: intermediate boxes that decrypt the key from the upstream segment, re-encrypt it under a new QKD-derived key, and pass it downstream.

Every trusted node holds plaintext key material. Every trusted node is a new physical attack surface, a new insider-threat surface, and a new compliance scope. A continental QKD backbone with trusted-node relays every 100 km is, from a key-compromise standpoint, structurally weaker than a single end-to-end PQC tunnel running over the same fibre—because the PQC tunnel never decrypts the payload in the middle.

Satellite QKD (Micius, the planned EuroQCI space segment) sidesteps the terrestrial range limit but introduces its own constraints: low duty cycles, weather sensitivity, expensive ground stations, and orbital mechanics that mean any given pair of endpoints has line-of-sight contact for minutes per day. For an identity stack that needs a verification answer in real time, on demand, anywhere, this is not a substitute for anything.

Quantum-safe identity, defined

If a vendor tells you their identity platform is quantum-safe because it integrates with QKD, the right next question is: what does the QKD link actually carry, and what does it do for the user logging in from a phone on a public LTE network? In nearly every case, the honest answer is "nothing for that user." The QKD link sits between two data centres and protects bulk key replication. It is a real engineering decision and may be justified on its own terms. It is not the property that makes the platform quantum-safe for identity.

A quantum-safe identity platform, in the operational sense that matters in 2026, has these properties:

1. Hybrid post-quantum signatures on every credential. ML-DSA-65 alongside a classical algorithm, in a single envelope, so the credential survives the failure of either layer. PasskeyBridge ships this today on every W3C VC 2.0 issuance, every cross-reference binding, every cached proof, and every spatial binding attestation.
2. PQ-secure key encapsulation for transport. ML-KEM (FIPS 203) replacing classical Diffie-Hellman in the key exchange that establishes session secrets, so harvested transcripts cannot be decrypted retroactively.
3. QRNG-seeded entropy for every nonce, every key generation, every challenge. Quantum-grade randomness is the only way to make the PQC algorithms above mean what they claim to mean.
4. Zero-PII architecture so that even if a future cryptanalytic break leaks signed payloads, no primary identifier (phone number, email, government ID) is exposed.
5. Migration on a per-tenant flag, with no forklift upgrade. Enterprise tenants enable PQC on their VC provider configuration and the stack starts emitting hybrid envelopes without code changes downstream.

None of those properties require QKD. All of them are deployable on the public internet today. This is the architecture that survives the quantum transition for identity. It is also the architecture that survives the much more immediate transition of agentic commerce, multi-carrier identity, and non-terrestrial trust roots, because it is built for the actual shape of the problem.

Outlook for QKD

QKD is a genuine technological achievement and an active area of physics, engineering, and standardisation. It will continue to mature. Over the next ten years it will find a permanent, narrow home in inter-data-centre links for institutions whose threat model genuinely justifies the cost, in national quantum communication backbones funded as strategic infrastructure, and in satellite-to-ground links for fixed earth stations that benefit from information-theoretic key distribution.

What QKD will not do, on any realistic horizon, is solve the identity verification problem. That problem is mobile, dynamic, public-internet, and dominated by authentication rather than eavesdropping. It needs post-quantum signatures, post-quantum key encapsulation, quantum-grade entropy, and zero-PII architecture, deployable across carriers, devices, and jurisdictions, inside a login's own latency budget.

That is the work. It is shippable today. It does not require a single photon over a dedicated fibre.

Read the technical whitepaper → | See the FIPS 204 deep dive → | Start building →

Start free · Test the API